FE-1265: Carry approved contracts into worker execution

[kostandinang]

Why

Planner summaries can omit exact approved requirements and public-contract details before a slice reaches its sealed worker, allowing a locally green implementation to miss the comparison contract.

What

Carry exact cumulative requirement bodies and a run-pinned, hash-verified public packet into every worker request. Reject malformed scope markers, ambiguous requirement authority, packet mutation, hidden extra files, and symlink escapes across serial, parallel, retry, and superseding-run paths.

How to test

1. Prepare a scoped task whose approved requirement contains a detail omitted from the planner summary, plus a target-visible public packet.
2. Start execution and let the scoped worker complete.
3. Confirm the output follows both the omitted requirement detail and the public packet while controller-only files remain outside the slice worktree.
4. Mutate the public packet after run creation, then resume the run and confirm execution stops before worker dispatch with a contract-validation error.

[kostandinang]

• FE-1265: Carry approved contracts into worker execution #377 👈 (View in Graphite)
• next

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

PR Summary

Medium Risk
Touches core execute-mode run admission, slice request lowering, and worker prompt composition—high-impact paths—but changes are bounded, heavily tested, and fail closed rather than widening execution authority.

Overview
I69-L worker contract carry closes the gap where sealed slice workers could see requirement ids or planner paraphrase instead of the approved contract text.

The executor now resolves cumulative approved requirement titles and bodies (including transitive slice dependencies) into each slice request.json, persists hash-verified target-visible public packet bytes on run creation, and stages only those pinned spec.md / public-contract.json files into the slice worktree—excluding controller-only oracle material. AgentRunnerPort validates scoped requests and renders Approved requirements and Target-visible public packet sections in the worker task.

Admission is fail-closed for malformed scope_handoff_required markers, unresolved or duplicate requirement authority, packet hash drift, partial packets, symlink escapes, and unexpected extra packet files; behavior is aligned across serial, parallel, superseding runs, and repair paths. Plan preview/spec now carry requirement titles alongside bodies. SPEC/PLAN document invariant I69-L and related verification; the linear-pr-cleanup skill’s How to test guidance is tightened to user-step scenarios.

^{Reviewed by Cursor Bugbot for commit 76d4f46. Bugbot is set up for automated code reviews on this repo. Configure here.}